Upgrade to Pro — share decks privately, control downloads, hide ads and more …

2000day in Safari

Avatar for Bo0oM Bo0oM
May 21, 2019
2.3k
2

2000day in Safari

Avatar for Bo0oM

Bo0oM

May 21, 2019

More Decks by Bo0oM

See All by Bo0oM
Носок на сок
Avatar for Bo0oM bo0om
0
1.9k
Выйди и зайди нормально
Avatar for Bo0oM bo0om
0
120
Защита от вредоносной автоматизации сегодня
Avatar for Bo0oM bo0om
0
680
Defending against automatization using nginx
Avatar for Bo0oM bo0om
0
920
Antibot pitch deck
Avatar for Bo0oM bo0om
0
200
31337
Avatar for Bo0oM bo0om
0
260
Your back is white
Avatar for Bo0oM bo0om
0
420
FTP2RCE
Avatar for Bo0oM bo0om
1
7.8k
Interpret it!
Avatar for Bo0oM bo0om
0
1.2k

Featured

See All Featured
Groundhog Day: Seeking Process in Gaming for Health
Avatar for Sebastian Deterding codingconduct
0
330
Faster Mobile Websites
Avatar for Dean Hume deanohume
310
32k
Stewardship and Sustainability of Urban and Community Forests
Avatar for Eric Wiseman pwiseman
0
510
The Mindset for Success: Future Career Progression
Avatar for Greg Gifford greggifford
PRO
0
490
Visual Storytelling: How to be a Superhuman Communicator
Avatar for David Neal reverentgeek
2
650
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
413
23k
Optimizing for Happiness
Avatar for Tom Preston-Werner mojombo
378
71k
Understanding Cognitive Biases in Performance Measurement
Avatar for Philip Tellis bluesmoon
32
3k
Art, The Web, and Tiny UX
Avatar for Lynn Fisher lynnandtonic
304
22k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
72
12k
Avoiding the “Bad Training, Faster” Trap in the Age of AI
Avatar for Mike Taylor tmiket
0
230
Technical Leadership for Architectural Decision Making
Avatar for Kenny Baas-Schwegler baasie
3
560

Transcript

  1. 2000-day in Safari Anton Lopanitsyn @i_bo0om

  2. phdays.com #PHDays XSS https://portswigger.net/web-security/cross-site-scripting

  3. phdays.com #PHDays UXSS https://evil.com https://victim.com

  4. phdays.com #PHDays Save as webpage, complete

  5. phdays.com #PHDays chrome://flags

  6. phdays.com #PHDays MHTML

  7. phdays.com #PHDays MHTML

  8. phdays.com #PHDays

  9. phdays.com #PHDays Safari save as webarchive

  10. phdays.com #PHDays Signed webarchive

  11. phdays.com #PHDays Plaintext webarchive

  12. phdays.com #PHDays Plaintext webarchive <script> … </script>

  13. phdays.com #PHDays Plaintext webarchive

  14. phdays.com #PHDays

  15. phdays.com #PHDays https://blog.rapid7.com/2013/04/25/abusing-safaris-webarchive-file-format/

  16. phdays.com #PHDays

  17. phdays.com #PHDays

  18. phdays.com #PHDays

  19. phdays.com #PHDays

  20. phdays.com #PHDays

  21. phdays.com #PHDays xhtml

  22. phdays.com #PHDays xhtml

  23. phdays.com #PHDays file:///Users/bo0om/Library/Containers/com.apple.mail/Data/Library/Mail%20 Downloads/2F4D2013-CCBF-4341-B05E-CEB4B76F30CE/Document.xhtm file:///Users/bo0om/Downloads/33h0ygug3ulny0gvwhh3d.webarchive

  24. phdays.com #PHDays

  25. phdays.com #PHDays file:///Users/bo0om/Library/Containers/com.apple.mail/Data/Downloads/x.webarchive file:///Users/bo0om/Library/Containers/com.apple.mail/Downloads/x.webarchive file:///Users/bo0om/Library/Containers/Downloads/x.webarchive file:///Users/bo0om/Library/Downloads/x.webarchive file:///Users/bo0om/Downloads/x.webarchive

  26. phdays.com #PHDays DEMO https://github.com/Bo0oM/Safari2000day)

  27. Thank you!